CVE-2026-27982

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27982", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2026-02-25T04:48:37.210Z", "datePublished": "2026-03-05T05:31:25.711Z", "dateUpdated": "2026-03-06T18:19:55.985Z"}, "containers": {"cna": {"affected": [{"vendor": "allauth", "product": "django-allauth", "versions": [{"version": "prior to 65.14.1", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL."}], "problemTypes": [{"descriptions": [{"description": "URL redirection to untrusted site ('Open Redirect')", "lang": "en-US", "cweId": "CWE-601", "type": "CWE"}]}], "references": [{"url": "https://allauth.org/news/2026/02/django-allauth-65.14.1-released/"}, {"url": "https://jvn.jp/en/jp/JVN23669411/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-03-05T05:31:25.711Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T18:19:44.307456Z", "id": "CVE-2026-27982", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:19:55.985Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27982", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2026-02-25T04:48:37.210Z", "datePublished": "2026-03-05T05:31:25.711Z", "dateUpdated": "2026-03-06T18:19:55.985Z"}, "containers": {"cna": {"affected": [{"vendor": "allauth", "product": "django-allauth", "versions": [{"version": "prior to 65.14.1", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL."}], "problemTypes": [{"descriptions": [{"description": "URL redirection to untrusted site ('Open Redirect')", "lang": "en-US", "cweId": "CWE-601", "type": "CWE"}]}], "references": [{"url": "https://allauth.org/news/2026/02/django-allauth-65.14.1-released/"}, {"url": "https://jvn.jp/en/jp/JVN23669411/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-03-05T05:31:25.711Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27982", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-06T18:19:44.307456Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:19:47.574Z"}}]}}

{"affected": [{"affectedData": [{"product": "django-allauth", "vendor": "allauth", "versions": [{"status": "affected", "version": "prior to 65.14.1"}]}], "source": "vultures@jpcert.or.jp"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:allauth:allauth:*:*:*:*:*:django:*:*", "matchCriteriaId": "1826656C-B476-4273-98AD-EE413464FAC2", "versionEndExcluding": "65.14.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by default), which may allow an attacker to redirect users to an arbitrary external website via a crafted URL."}, {"lang": "es", "value": "Existe una vulnerabilidad de redirecci\u00f3n abierta en las versiones de django-allauth anteriores a la 65.14.1 cuando el SSO iniciado por el IdP de SAML est\u00e1 habilitado (est\u00e1 deshabilitado por defecto), lo que puede permitir a un atacante redirigir a los usuarios a un sitio web externo arbitrario a trav\u00e9s de una URL manipulada."}], "id": "CVE-2026-27982", "lastModified": "2026-06-17T10:28:00.937", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27982", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T18:19:44.307456Z", "version": "2.0.3"}}]}, "published": "2026-03-05T06:16:30.100", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Release Notes"], "url": "https://allauth.org/news/2026/02/django-allauth-65.14.1-released/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN23669411/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{"bugzilla": {"description": "django-allauth: django-allauth: Open redirect via crafted URL in SAML IdP initiated SSO", "id": "2444764", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444764"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-601", "details": ["A flaw was found in django-allauth. This open redirect vulnerability exists when Security Assertion Markup Language (SAML) Identity Provider (IdP) initiated Single Sign-On (SSO) is enabled, which is disabled by default. A remote attacker could exploit this by crafting a malicious URL, potentially redirecting users to an arbitrary external website. This could lead to information disclosure or phishing attacks."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, ensure that SAML IdP initiated SSO is disabled in django-allauth. This feature is disabled by default, so no action is required if the default configuration has been maintained. If SAML IdP initiated SSO was previously enabled, disable it in your django-allauth configuration."}, "name": "CVE-2026-27982", "public_date": "2026-03-05T05:31:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-27982\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-27982\nhttps://allauth.org/news/2026/02/django-allauth-65.14.1-released/\nhttps://jvn.jp/en/jp/JVN23669411/"], "statement": "MODERATE: This open redirect vulnerability in django-allauth affects systems where SAML IdP initiated SSO is explicitly enabled. By default, SAML IdP initiated SSO is disabled, which limits the exposure for Red Hat products. Systems with the default configuration are not affected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,65.14.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "django-allauth", "vendor": "allauth"}], "analysis": {"en": {"generated_at": "2026-04-17T12:57:04.554404+00:00", "value": {"mitigation_remediation": ["Upgrade django-allauth to version 65.14.1 or newer.", "Disable SAML IdP initiated SSO if the feature is not needed.", "Configure the application to validate redirect targets against a whitelist of trusted domains to mitigate remaining open redirect risk."], "summary": {"action": "Patch", "impact": "Open redirect"}, "threat_synthesis": {"affected_systems": "Systems that use the django-allauth library installed with a version older than 65.14.1 and have SAML IdP initiated SSO enabled are affected. This includes any Django application that imports allauth:django-allauth and has not applied the 65.14.1 release. The vulnerability is present in all custom installations that enable the feature without a URL whitelist.", "description_and_impact": "The vulnerability is an open redirect flaw in the SAML IdP initiated SSO feature of django-allauth. Prior to version 65.14.1, attackers can craft URLs that cause authenticated users to be sent to arbitrary external websites once the feature is enabled. This could be used for phishing or social engineering attacks, compromising user trust and potentially exposing sensitive data. The weakness is identified as CWE-601.", "risk_and_exploitability": "The assigned CVSS score of 5.1 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the general population. However, because the attack vector relies on user interaction with a crafted link, the risk is largely contingent on the attacker\u2019s ability to lure users to the malicious URL. The vulnerability is not currently listed in the CISA KEV catalog, but administrators should still patch promptly to prevent phishing or credential compromise scenarios."}}}}, "created": "2026-03-06T15:17:49.098924+00:00", "updated": "2026-04-17T13:00:12.022881+00:00", "vendors": ["allauth", "allauth$PRODUCT$django-allauth"]}